active-directory-skill

Analyze Active Directory attack techniques and generate ELK detection queries.

Updated Jan 2, 2026

Search Tags:#log-analysis #active-directory #threat-detection #kerberos #ldap #elk #windows-event-logs

Ready to run

npx skills add https://github.com/SeeKT/Active-Directory-Forge-Ticket-Agent-ELK --skill active-directory-skill

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: active-directory-skill
Source: https://github.com/SeeKT/Active-Directory-Forge-Ticket-Agent-ELK/tree/main/.github/skills/active-directory
Command: npx skills add https://github.com/SeeKT/Active-Directory-Forge-Ticket-Agent-ELK --skill active-directory-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This skill provides a comprehensive framework for understanding Active Directory attack techniques and Windows event-log based detections, equipping security teams to analyze incidents and implement ELK-integrated defenses.

Core Features & Use Cases

Kerberos-based attack coverage (TGT/ST/AS-REQ/PK) and authentication flows, with detection guidance.
Domain trust abuse, LDAP operations, privilege escalation, persistence techniques, and log-analysis detections.
ELK integration for SIEM workflows: Kibana dashboards and detection queries to support incident response and threat hunting.

Quick Start

Load the Active Directory Attack & Detection Skill into your agent and ask for practical detection guidance. Example: "Show me Kibana queries to detect Kerberoasting in Windows Event Logs." Another example: "Provide a detection plan for Pass-the-Ticket events using Event IDs 4769 and 4624."

Frequently Asked Questions about active-directory-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect Kerberoasting using Windows event logs?▼

To detect Kerberoasting using Windows event logs, you analyze Event ID 4769 for unusual Kerberos Ticket Granting Service requests with specific encryption types. This skill generates targeted detection queries and defense strategies for Kerberos-based attacks.

What is the best way to monitor Active Directory privilege escalation in ELK?▼

Monitoring Active Directory privilege escalation in ELK involves ingesting Windows event logs and building Kibana dashboards to track unauthorized access token modifications. This skill provides ELK-integrated threat detection workflows and analytics queries for incident response.

Can I use this skill for Pass-the-Ticket detection with Event IDs 4769 and 4624?▼

Yes, you can use this skill for Pass-the-Ticket detection by correlating Event IDs 4769 and 4624 to identify anomalous Kerberos ticket usage. It provides a comprehensive detection plan and practical queries for Windows event-log based threat hunting.

How does LDAP query monitoring help with Active Directory threat detection?▼

LDAP query monitoring helps with Active Directory threat detection by exposing abnormal directory search patterns that indicate reconnaissance or domain trust abuse. This skill covers LDAP operations and provides log-analysis detections to support threat hunting workflows.

Does this skill provide Kibana queries for Windows event log analysis?▼

Yes, this skill provides Kibana queries for Windows event log analysis to detect Active Directory attack techniques. It integrates with ELK workflows to support incident response, producing specific detection queries for Kerberos, LDAP, and privilege escalation events.